Integrate CrowdStrike Falcon Antivirus
Overview
You can integrate CrowdStrike Falcon Antivirus to scan files during Transfer and detect or block potential threats.
Once configured, files are scanned according to the selected Scan timing. If a threat is detected, the configured On detection action is applied to block the Transfer or generate an alert. The files to be scanned are determined by the selected Scan scope.
The overall process consists of the following steps:
① Verify API Credentials → ② Configure the Integration in the Product
Prerequisites
Before you begin, verify the following requirements.
| Item | Description |
|---|---|
| CrowdStrike Account | Access to the CrowdStrike Falcon Console with permission to create API clients is required. |
| API Credentials | A Client ID and Client Secret are required. |
| Cloud Region | The Base URL for your account's cloud region is required. |
| Network | The environment where the product is installed must allow outbound HTTPS communication (port 443) to the regional Base URL. |
Verify API Credentials
To scan files with CrowdStrike Falcon, you need a Client ID, Client Secret, and the regional Cloud Region Base URL.
Step 1. Create an API Client
In the Falcon Console, open API Clients & Keys, create an API client, and copy the generated Client ID and Client Secret. The Client Secret is displayed only once when it is created.
Treat these credentials as passwords. Anyone with access to them can use the scanning API, so do not expose them in public repositories or external documentation. If the credentials are compromised, revoke them and generate new ones.
Step 2. Verify the Cloud Region Base URL
Verify the Base URL for your account's cloud region (for example, https://api.crowdstrike.com). Authentication fails if the wrong region is used.
Verification
✔ A Client ID and Client Secret have been generated.
✔ The Cloud Region Base URL has been verified.
Configure CrowdStrike Falcon Integration
Enter the verified credentials and configure the scanning options.
When you open the Security configuration page, the following screen is displayed.
Step 1. Enter the Client ID
Enter the Client ID generated in the "Verify API Credentials" section into the Client ID field.
Step 2. Enter the Client Secret
Enter the Client Secret generated in the "Verify API Credentials" section into the Client Secret field.
Step 3. Enter the Cloud Region Base URL
Enter the regional Base URL in the Cloud Region Base URL field (for example, https://api.crowdstrike.com).
Step 4. Select Scan Timing
Select when files should be scanned in Scan timing.
| Option | Description |
|---|---|
| Before transfer at source | Scan files on the source before the Transfer starts. |
| After transfer at target | Scan files on the target after the Transfer completes. |
| Bothway | Scan files both before the Transfer at the source and after the Transfer at the target. |
Step 5. Select On Detection
Select how the system should respond when a threat is detected in On detection.
| Option | Description |
|---|---|
| Block transfer | Block the Transfer when a threat is detected. |
| Alert only | Allow the Transfer to continue and generate an alert only. |
| Admin confirm | Require administrator confirmation before proceeding. |
Step 6. Select Scan Scope
Select which files should be scanned in Scan scope.
| Option | Description |
|---|---|
| All files | Scan every transferred file. |
| Executable files only | Scan executable files only. |
| Custom exceptions | Scan files according to user-defined exception rules. |
Step 7. Save the Configuration
After completing the configuration, click Add to save the integration.
Verification
✔ The Client ID, Client Secret, and Cloud Region Base URL have been entered.
✔ The Scan timing, On detection, and Scan scope options have been selected.
Verify the Integration
Verify that the integration is operating correctly.
Step 1. Perform a Test Transfer
Transfer a file to verify that scanning is performed. You can safely verify the scanning behavior using a standard antivirus test file such as EICAR.
Step 2. Verify the Result
Verify that the configured On detection action is applied correctly (for example, Block transfer blocks the Transfer, while Alert only generates a warning).
Verification
✔ File scanning has been performed.
✔ The configured detection action is applied correctly.
Configuration Complete
After the configuration is saved, the integration becomes active.
From this point forward, transferred files are scanned according to the configured timing and scope. If a threat is detected, the configured action is applied automatically.
Troubleshooting
If scanning does not operate correctly, verify the following.
| Issue | Verification |
|---|---|
| Scanning is not performed | Verify that the Client ID, Client Secret, and Cloud Region Base URL are correct. |
| Authentication error occurs | Verify that the Client ID and Client Secret are valid and have not been revoked or regenerated. |
| Region mismatch | Verify that the account's cloud region matches the configured Cloud Region Base URL. |
| Threats are detected but Transfers are not blocked | Verify that On detection is set to Block transfer. |
| Certain files are not scanned | Verify the Scan scope configuration (All files, Executable files only, or Custom exceptions). |
| Transfer performance is slower | When Bothway is selected for Scan timing, files are scanned at both the source and target, which may increase processing time. Adjust the setting if necessary. |
| Integration fails in a restricted network | Verify that outbound HTTPS communication (port 443) to the regional Base URL is allowed. |